Crash if gtk_paint_layout is called with widget==NULL

[ooze]

Binary package hint: gtk2-engines-murrine

How to reproduce:

In Lucid Lynx, opening gnome-nettool (System>Administrstion>Network Tools) and clicking the Ping tab causes a function call to gtk_paint_layout, where the widget parameter is NULL (src/ping.c:166). This will cause gnome-nettool to crash in murrine code. However this should be permitted by the specification [1].

The murrine theme crashes in murrine_style_draw_layout (src/murrine_style.c:1983) because the widget pointer is dereferenced without checking for NULL.

gtk2-engines-murrine:
  Installé : 0.90.3+git20100323-0ubuntu1
  Candidat : 0.90.3+git20100323-0ubuntu1
 Table de version :
 *** 0.90.3+git20100323-0ubuntu1 0
        500 http://ca.archive.ubuntu.com/ubuntu/ lucid/main Packages
        100 /var/lib/dpkg/status

[1] http://library.gnome.org/devel/gtk/unstable/GtkStyle.html#gtk-paint-layout
---
Architecture: amd64
CheckboxSubmission: d40bce42059ae59963635568573a6163
CheckboxSystem: bb422ca46d02494cdbc459927a98bc2f
DistroRelease: Ubuntu 10.04
InstallationMedia: Ubuntu 10.04 "Lucid Lynx" - Alpha amd64 (20100131)
Package: gtk2-engines-murrine 0.90.3+git20100323-0ubuntu1
PackageArchitecture: amd64
ProcEnviron:
 LANG=fr_CA.utf8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.32-17.26-generic 2.6.32.10+drm33.1
Tags: lucid
Uname: Linux 2.6.32-17-generic x86_64
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare

[ooze (zoe-gauthier)]

apport information

[Fabián Rodríguez (magicfab)]

Confirming as medium, as this could mean other crashers related to this theme.

[Sebastien Bacher (seb128)]

Thank you for your bug report. The issue is an upstream one and it would be nice if somebody having it could send the bug the to the people writting the software (https://wiki.ubuntu.com/Bugs/Upstream/GNOME)

[Andrea Cimitan (cimi)]

Try updating to latest git revision

[ooze (zoe-gauthier)]

Andrea: Sorry, it doesn't work. It will still enter the condition because the expression "(&MURRINE_STYLE (style)->textstyle != 0 && state_type != GTK_STATE_PRELIGHT)" is TRUE. Some parentheses are missing. Thanks!

[Andrea Cimitan (cimi)]

That's true! Sorry I was busy updating my facebook profile image :)

Fixed now?

[ooze (zoe-gauthier)]

Andrea: Yes, thanks again!

Can the Ubuntu package be updated to the latest murrine Git master with this fix as soon as possible? :)

[Fabián Rodríguez (magicfab)]

Thanks to Calysto (Claire) for the initial problem report and to Philippe for the detailed bug report - this happened during the Ubuntu Global Jam last weekend and we learned a lot. I've subscribed Claire in case she wants to test this once it makes it into Lucid.

[Aleksander Morgado (aleksander-m)]

This bug is not the equal to the one reported in Gnome Bugzilla (554871), the remote bug watch should be removed.

[ooze (zoe-gauthier)]

> This bug is not the equal to the one reported in Gnome Bugzilla
It has been corrected by upstream now. Thanks!

I was wondering if it would be useful if I create a branch containing this fix only. Otherwise it doesn't seem that it will be included in Lucid in time for the release. I'm not confident enough about my skills to create a package that is synced with murrine's git head.

[Aleksander Morgado (aleksander-m)]

Well, now it's not clear if the bug you commented in #554871 is the one fixed, or the one fixed is the original bug report in #554871 :-)

Could you please check if the upstream git version has the same fix as you have?

[Dj Weidert (ofthesaved)]

Dear Aleksander
I am fairly new to the linux operating system but eager to learn how to
operate in it. Im still trying to learn all of the commands for the
terminal. Ill be happy to check the "upstream git version", but i need
to know what to enter in the terminal"

On Fri, 2010-04-16 at 07:45 +0000, Aleksander Morgado wrote:
> Well, now it's not clear if the bug you commented in #554871 is the one
> fixed, or the one fixed is the original bug report in #554871 :-)
>
> Could you please check if the upstream git version has the same fix as
> you have?
>

--
For in Him darkness does not exist only the essence of life as it drips
from his pen.

[Launchpad Janitor (janitor)]

This bug was fixed in the package gtk2-engines-murrine - 0.90.3+git20100323-0ubuntu3

---------------
gtk2-engines-murrine (0.90.3+git20100323-0ubuntu3) lucid; urgency=low

  * debian/patches/90_git_null_widget_crash.patch:
    - git change to fix a crasher in gtk_paint_layout() on null widgets
      (lp: #548952) (lp: #549281)
  * debian/patches/91_git_font_rendering.patch:
    - git change to fix a font rendering issue since the theme update
      (lp: #546485)
 -- Sebastien Bacher <email address hidden> Mon, 19 Apr 2010 18:17:56 +0200

[Uri (oriol-castejon)]

Hi,
I'm trying the Ubuntu 10.04 Release Candidate iso, and it seems this bug hasn't been solved yet. I guess you are already aware of that, but I just wanted to be sure!

[ooze (zoe-gauthier)]

Uri: You need to update your system at least once. The updated package is only available from the archives since yesterday. You can use the command "apt-get policy gtk2-engines-murrine" to make sure you have the right package version (see comment #13) Thanks!

[ooze (zoe-gauthier)]

Uri: Sorry, replace "apt-get" with "apt-cache" in the previous comment.

[Uri (oriol-castejon)]

Thanks Philippe, system updated and right package installed.